Chapter 21: Jenkins Pipeline and Jenkinsfile

21.3 Create a Pipeline job from SCM

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

When you type a Jenkinsfile into the job page box, it works. But it is the same old problem. The code lives in Jenkins, not in Git. The right way is Pipeline script from SCM. SCM means source code management, like Git. The job only stores three things: the repo URL, the branch, and the path of the Jenkinsfile. On every build, Jenkins clones the repo and reads the file. Think of Paytm. Their payments repo has the Jenkinsfile next to the code. A developer changes the test command in a pull request. The reviewer sees the change. After merge, the next build uses it. No one opens the Jenkins job page at all. In this lesson you will create a private repo, store a read-only credential in Jenkins, and point a Pipeline job at the Jenkinsfile.

What we will build

You will push the badge Node app with a Jenkinsfile to a Git server. You will add a credential for clone access. You will create a Pipeline job from SCM, run it, and see the exact commit it built.

What: every term in plain English

• SCM — Source code management. Here it means Git.
• Pipeline script from SCM — Job setting that reads the Jenkinsfile from Git on every build.
• Repository URL — Where Jenkins clones from, HTTPS or SSH.
• Branch specifier — Which branch to build, like */main.
• Script Path — Path of the Jenkinsfile inside the repo. Default Jenkinsfile.
• Credentials ID — The name of a stored login, like git-readonly. Jenkins keeps the secret.
• Lightweight checkout — Jenkins reads only the Jenkinsfile first, without a full clone.
• checkout scm — Step that clones the same repo and commit the job used.

How: step by step

1. Push the repo

   git remote add origin https://git.example.com/team/badge-node.git
   git push -u origin main
   

   What it does: The app and Jenkinsfile are on the Git server.

   Output

   Branch main set up to track origin/main.
   

2. Add a credential

   Manage Jenkins > Credentials > System > Global > Add > Username with password > ID: git-readonly
   

   What it does: Stores a read-only token. Only the ID goes in jobs.

   Output

   git-readonly created
   

3. Create the job

   New Item > badge-scm > Pipeline > OK
   

   What it does: A blank Pipeline job.

   Output

   Saved
   

4. Point to Git

   Definition: Pipeline script from SCM
   SCM: Git
   Repository URL: https://git.example.com/team/badge-node.git
   Credentials: git-readonly
   Branch: */main
   Script Path: Jenkinsfile
   

   What it does: Jenkins now reads the build from the repo.

   Output

   Saved
   

5. Run it

   Build Now > Console Output
   

   What it does: Jenkins clones and runs the stages.

   Output

   Checking out Revision 4b2d9e1 (refs/remotes/origin/main)
   

6. Check the commit

   Build page > Changes and Git Build Data
   

   What it does: Shows which commit was built.

   Output

   Revision: 4b2d9e1a... Branch: origin/main
   

Example 1: The repo layout Jenkins expects

Stack. Git repo

Goal. The repo layout Jenkins expects.

tree

badge-node/
  Jenkinsfile
  package.json
  package-lock.json
  src/
    index.js
  test/
    index.test.js

What each line does

• Jenkinsfile — At the root, so Script Path stays default.
• package-lock.json — Needed for npm ci.
• test/ — npm test runs these files.

Green output

$ git ls-files
Jenkinsfile
package-lock.json
package.json
src/index.js
test/index.test.js

Expected result. Jenkins finds the file without extra settings.

Example 2: A Jenkinsfile that prints what it built

Stack. Jenkins Pipeline from SCM

Goal. A Jenkinsfile that prints what it built.

Jenkinsfile

pipeline {
  agent any
  stages {
    stage('Info') {
      steps {
        echo "Job: ${env.JOB_NAME}  Build: ${env.BUILD_NUMBER}"
        echo "Commit: ${env.GIT_COMMIT}"
        echo "Branch: ${env.GIT_BRANCH}"
        sh 'git log -1 --pretty=format:"%an %s"'
      }
    }
    stage('Test') {
      steps {
        sh 'npm ci'
        sh 'npm test'
      }
    }
  }
}

What each line does

• env.JOB_NAME — Name of the job.
• env.BUILD_NUMBER — Build count, 1, 2, 3.
• env.GIT_COMMIT — Full commit hash, set by the Git plugin.
• env.GIT_BRANCH — Branch name, like origin/main.
• git log -1 — Author and message of the last commit.

Green output

Checking out Revision 4b2d9e1a7f (refs/remotes/origin/main)
[Pipeline] stage (Info)
Job: badge-scm  Build: 1
Commit: 4b2d9e1a7f3c0e55a8b21d9f0c6e7a4b1d2c3e4f
Branch: origin/main
+ git log -1 --pretty=format:%an %s
Asha Patil ci: move build into Jenkinsfile
[Pipeline] stage (Test)
Tests: 9 passed, 9 total
Finished: SUCCESS

Expected result. Every build tells you the exact commit. Bugs can be traced to a change.

Example 3: Use SSH instead of HTTPS for the clone

Stack. Git over SSH, Jenkins credentials

Goal. Use SSH instead of HTTPS for the clone.

terminal

ssh-keygen -t ed25519 -f jenkins_deploy -N "" -C "jenkins-readonly"
cat jenkins_deploy.pub
# add this public key as a read-only deploy key on the repo
ssh-keyscan git.example.com

job settings

Repository URL : git@git.example.com:team/badge-node.git
Credentials    : git-ssh (SSH Username with private key)
Manage Jenkins > Security > Git Host Key Verification: Known hosts file

What each line does

• ssh-keygen -t ed25519 — Makes a new key pair for Jenkins only.
• -N "" — No passphrase, so Jenkins can use it.
• deploy key — A key that can read one repo only.
• ssh-keyscan — Prints the server host key for known_hosts.
• Host key verification — Stops fake servers. Do not turn it off.

Green output

Generating public/private ed25519 key pair.
Your identification has been saved in jenkins_deploy
ssh-ed25519 AAAAC3Nza... jenkins-readonly
...
Fetching upstream changes from git@git.example.com:team/badge-node.git
Checking out Revision 4b2d9e1a7f
Finished: SUCCESS

Expected result. SSH clone works with a read-only key. Delete the private key file from your laptop after adding it to Jenkins.

Example 4: Keep the Jenkinsfile in a sub folder

Stack. Jenkins Pipeline from SCM

Goal. Keep the Jenkinsfile in a sub folder.

repo

badge-node/
  ci/
    Jenkinsfile.build
    Jenkinsfile.nightly
  src/
  package.json

job settings

Job badge-build   : Script Path ci/Jenkinsfile.build
Job badge-nightly : Script Path ci/Jenkinsfile.nightly
Lightweight checkout : checked

What each line does

• ci/ folder — Some teams keep all pipeline files together.
• Two Script Paths — Two jobs from one repo, each with its own file.
• Lightweight checkout — Jenkins reads only the file first, which is faster for big repos.
• Workspace root — Commands still run from the repo root, not from ci/.

Green output

Obtained ci/Jenkinsfile.build from git https://git.example.com/team/badge-node.git
[Pipeline] stage (Build)
+ npm ci
added 270 packages in 8s
Finished: SUCCESS

Expected result. Script Path decides which file runs. Keep the name clear so people find it fast.

Verify: did it work?

1. See the cloned folder

   docker exec jenkins ls /var/jenkins_home/workspace/badge-scm
   

   What it does: Shows the files Jenkins cloned.

   Output

   Jenkinsfile
   package.json
   src
   test
   

2. Read Git Build Data

   Build #1 > Git Build Data
   

   What it does: Shows URL, branch and commit.

   Output

   Built Branches: origin/main 4b2d9e1
   

When it is red 1

stderr: remote: HTTP Basic: Access denied
fatal: Authentication failed

Cause. Wrong token or the credential is not selected.

Fix, step by step

1. Make a new read-only token.
2. Update git-readonly.
3. Pick it in the job.

When it is red 2

Couldn't find any revision to build. Verify the repository and branch configuration for this job.

Cause. The branch name is wrong, like */master on a main repo.

Fix, step by step

1. Run git branch -r on your laptop.
2. Set */main.

When it is red 3

No ED25519 host key is known for git.example.com and you have requested strict checking.

Cause. Host key not trusted yet.

Fix, step by step

1. Add ssh-keyscan output to known hosts on the controller.
2. Or pick Accept first connection in Git Host Key Verification.

Cleanup

1. Remove the job

   badge-scm > Delete Pipeline
   

   What it does: Removes the practice job.

   Output

   Deleted
   

2. Remove lab keys

   rm -f jenkins_deploy jenkins_deploy.pub
   

   What it does: Deletes the key files from your laptop.

   Output

   (no output)
   

Practice tasks

Homework: try at home

Recap

• Use Pipeline script from SCM, not the text box.
• The job stores URL, branch, credential ID and script path.
• Jenkins clones on every build.
• Print GIT_COMMIT to trace builds.
• Use read-only tokens or deploy keys.

FAQ

Can I build any branch?

Yes, set the branch specifier, or use Multibranch (lesson 21.8).

Is checkout scm needed in Declarative?

No, Declarative checks out by default. Use it in Scripted or after skipDefaultCheckout.

Where is the token stored?

Encrypted in Jenkins home, never in the Jenkinsfile.

Can the Jenkinsfile live in another repo?

Yes, but keep it with the app when you can.

What is lightweight checkout?

Jenkins reads only the Jenkinsfile first, then clones fully on the agent.

Interview questions

1. How do you create a Pipeline job from Git?

   New Item, Pipeline, Definition Pipeline script from SCM, Git URL, credential ID, branch and Script Path.

2. How do you know which commit a build used?

   Git Build Data on the build page, or env.GIT_COMMIT in the log.

3. HTTPS or SSH for Jenkins clones?

   Both work. SSH with a read-only deploy key and host key checking is common in companies.

4. Clone fails with Authentication failed. Steps?

   Check the token, scope, expiry and that the job uses the right credentials ID.

5. Why not paste the pipeline in the job box?

   No review, no history, and it is lost with the controller.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards